This post is part of our series on key aspects of the final HITECH omnibus rule issued by the U.S. Department of Health and Human Services (HHS) on January 17, 2013 (available here), and scheduled to be published in the Federal Register on January 25.  Previous posts are available here.  The regulations are effective March 26, 2013, but covered entities and business associates have until September 23, 2013, to comply with most new requirements. 

In addition to finalizing the HIPAA regulations under HITECH, the omnibus rule finalized modifications to the HIPAA Privacy rule required by the Genetic Information Non-Discrimination Act (GINA).  GINA prohibits discrimination in employment and health insurance coverage based on a person’s genetic information.  Specifically, GINA prohibits health plans from using the genetic information of an individual, for example that he or she is predisposed to develop a certain genetic disorder or carries a specific genetic mutation, for underwriting purposes.

GINA directed HHS to make modifications to the HIPAA Privacy Rule.  In October 2009, HHS promulgated proposed rules to:

• Clarify that genetic information is health information for purposes of PHI;
• Prohibit health plans from using or disclosing PHI containing genetic information for underwriting purposes;
• Revise the provisions related to the Notice of Privacy Practices for health plans that perform underwriting; and
• Make technical corrections to update the definition of “health plan.”

The structure of the final rules issued by HHS track these proposed rules, while making some modifications to the details of the individual proposals.  We discuss each of the major aspects of the proposed rule below.

Prohibition on Underwriting. Health plans may not use or disclose genetic information for underwriting purposes. This prohibition applies to all plans subject to the HIPAA Privacy Rule, with one exception. In a departure from the proposed rule, the final regulations exempt long-term care (LTC) insurers from this prohibition. However, HHS said that it will continue to look into ways to address privacy concerns raised by the use of genetic information for underwriting by LTC insurers–including through a study by the National Association of Insurance Commissioners (NAIC).

The final rule also makes clear that this prohibition is limited to health plans–a health care provider may use genetic information for treatment.

Definitions. The final regulations include definitions for the following terms:

• “health information” is defined to include “genetic information;”
• “genetic information” is defined to include any genetic information including an individual or family member but excludes information about age, sex, or non-genetic manifested diseases or disorders;
• “genetic tests” means analyses of DNA, RNA, chromosomes, proteins, or metabolites that detects genotypes, mutations, or chromosomal changes;
• “genetic services” means genetic tests, counseling, or education — including the fact that a person received a genetic test, counseling, or education;
• “family member” means any dependent or other individual who is a first, second, third, or fourth degree relative;
• “manifestation or manifested” means, with respect to a disease or disorder, that an individual could reasonably be diagnosed by a health care professional with appropriate training and expertise in the field involved and the diagnosis is not principally based on genetic information (diseases that are manifested are not subject to the prohibition);
• the definition of “health care operations” is amended to include a reference to the prohibition on using or disclosing genetic information for underwriting purposes.
• the definition of “payment” makes clear that health plans may use results of genetic tests for purposes of payment (such as determining eligibility for benefits) as long as these activities do not constitute “underwriting purposes.”

Notice of Privacy Practices (NPP). The final rule requires health plans that perform underwriting to include in their NPPs that they are prohibited from using or disclosing genetic information for this purpose, except with regard to LTC policies. Health plans that have already modified their NPPs to reflect the statutory prohibition in GINA are not required to re-issue their NPPs.